Skip to main content

Incident ResponderIncident Responder Documentation

Version: i56

Add a Filter Node

When you create a playbook, you add action, decision, and filter nodes. Add a filter node to narrow down multiple input values to a specific subset.Create a Playbook

You use a filter node to filter out a subset of the input source, based on conditions you specify when you configure the node. The filter node outputs the remaining subset and passes it on to the next node. The next node only evaluates this remaining subset. For example, you can use a filter node to remove:

  • Normal domains, so the next node evaluates malicious domains only.

  • Allow listed URLs, so the next node evaluates block listed URLs only.

  • Email attachments with a risk score below 90, so the next node evaluates attachments with a risk score above 90 only.

  • IP addresses from other countries, so the next node evaluates IP addresses from a specific country only.

To evaluate a single value, add a decision node.

  1. From one node, add another node, then select FILTER.

  2. Select an input source. You can select between the fields, entities, or artifacts in the incident or the output from a previous node.

  3. Select an operator:

    • Equals – Checks if values are equal.

    • Not Equal To – Checks if values are not equal.

    • Contains – Checks if values partially match.

    • Not Contains – Checks if values do not match.

    • Is Empty – Checks if incident field doesn't have an assigned value.

    • Exists – Checks if incident field has an assigned value.

    • Starts With – Checks if string data type starts with a specified value.

    • Not Starts With – Checks if string data type doesn't start with a specified value.

    • Ends With – Checks if string data type ends with a specified value.

    • Not Ends With – Checks if string value doesn't end with a specified value.

    • In – Checks if value is in a specified list.

    • Not In – Checks if value is not in a specified list.

    • Matches – Checks if values match exactly.

    • Not Matches – Checks if values don't match exactly.

    • Greater Than – Checks if value is greater than a specified value.

  4. (Optional) If relevant, enter or select a value.

  5. Click SAVE.

  6. (Optional) Add an additional condition to the filter node. You can't use both in one filter node; you must choose one or the other.

    • To add an or condition, select +OR.

    • To add an and condition, select +AND.

    • To change a condition from one to the other, select the down arrow next to it, then select the appropriate condition.

  7. To close the panel, click anywhere in the interface. If there is a red border around the node, you have not configured one or more necessary fields.